Setting up your organisation hierarchy
Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Setting up your organisation hierarchy
Arrange your cloud accounts into a tree that matches how your company is organised, see spend and resources roll up at every level, and limit people to their own branch.
Where in CostGlassSettings → Hierarchy
PlanAll plans
Who can do thisSee the note on who can edit
Time needed20 to 60 minutes, depending on how many accounts you have
In short
- The hierarchy is your own tree of nodes (called OUs on screen, for example "Engineering" or "Payments"). It is independent of the structure inside each cloud.
- Every connected cloud account (an AWS account, an Azure subscription, a Google Cloud project and so on) sits in exactly one node.
- You can place accounts by hand, with rules, or by uploading a CSV. New accounts wait at the top of the tree until you place them.
- Each node shows monthly spend, account count and resource count for itself and everything below it.
- You can bind a person to a node so they only see that part. Some pages cannot be narrowed this way and always show the whole organisation.
Before you begin
- At least one cloud account connected. See Connect your clouds.
- A rough idea of the structure you want. If you are unsure, read Designing your hierarchy first.
- A list of which account belongs to which team (a spreadsheet is ideal if you have many accounts).
What the hierarchy is
- Node (shown as OU or Department OU)
- One box in your tree, such as a business unit, a team or an environment. A node can contain other nodes (sub-units) and cloud accounts.
- Root
- The top of the tree. Every organisation has exactly one. It is labelled Enterprise Root and is named after your organisation. It cannot be deleted or moved.
- Native account
- A billing or ownership unit inside a cloud: an AWS account, an Azure subscription, a Google Cloud project, an Oracle tenancy, an Alibaba account, a DigitalOcean, Linode or Cloudflare account. These are what you place in the tree.
- Rollup
- The totals shown for a node: they add up the node itself and everything beneath it.
- Scoped access
- Binding a person to a node so they only see accounts under that node.
The hierarchy is separate from AWS Organizations, Azure Management Groups and similar structures. CostGlass does not read those layouts. You decide the tree, and it can combine accounts from different clouds in one place.
What can be placed in the tree
Only cloud accounts that CostGlass tracks as accounts (AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, DigitalOcean, Linode and Cloudflare). SaaS and AI vendors such as OpenAI or Datadog, and Kubernetes clusters, are not placed in the tree.
Open the page and find your way around
1
2
Read the summary cards
The top row counts Departments & OUs, Connected Clouds (accounts), Scoped Team Users and Root Unplaced Accounts. The last one is the number of accounts nobody has placed yet.
3
Select a node
Click any node in Organisation Tree. The right-hand side shows its breadcrumb, Monthly Spend, Total Accounts, Discovered Resources and Direct Child OUs, then three sections: Attached Cloud Accounts, Team Permissions & Scoped Access and Sub-Units.
Create and organise nodes
1
Add a top-level node
Click + New Department OU, type a name (for example Engineering) and click Save. It is created directly under the root.
2
Add a sub-node
Select a node and click + Add Sub-OU (also available from the tree footer), type a name and save.
3
Rename
Select the node and use the pencil icon beside its name. Press Enter or click Save.
4
Move
Select the node, click Move OU, pick the new parent under Move under: and click Confirm Move. You cannot move the root, or move a node under one of its own descendants.
5
Delete
Select the node and click Delete, then confirm in Delete Department OU?.
When delete is refused
A node cannot be deleted while it still has child nodes or accounts mapped to it, and the root can never be deleted. Move or reassign the contents first. Nothing is removed along with a node, so there is no data loss.
Tip
The tree has Expand All and Collapse All buttons and a filter box (Filter OUs & teams...) for large hierarchies.
Place accounts in nodes
An account belongs to exactly one node. Placing it somewhere new moves it. There are three ways to do it, and you can mix them.
1. By hand
1
Select the destination node
Click the node that should contain the accounts.
2
Attach accounts
In Attached Cloud Accounts click + Attach Accounts (or Attach an Account Now when empty). In the dialog Attach Accounts to ... tick the accounts and click Attach Selected.
3
Or move an account the other way
On an account row use the Move to OU… drop-down to send it to a different node.
2. All the unplaced accounts at once
When a new account is connected it lands on the root until you place it. The card Root Unplaced Accounts counts them. Click Assign All → or Unassigned Accounts (n), choose a Target Destination OU, tick the accounts and click Assign n Accounts.
3. With rules (Auto-Rules)
A rule says "send every account that matches this to that node". Click Auto-Rules (n) to open the Auto-Assignment Rules drawer and fill Add New Assignment Rule:
| Field | What it does | Options |
|---|---|---|
| Rule Name | A label for you. | Free text, for example "Route Prod". |
| Destination OU | The node matching accounts go to. | Any node. |
| Priority | Rules are tried from the lowest number to the highest; the first match wins. | A number. The default is 100. |
| Field | What to look at on the account. | Provider, Display Name, Account ID. |
| Operator | How to compare. | equals, contains, starts with. |
| Match Value | The text to compare with (not case sensitive). | Free text. |
Click Add Rule, then click Run Rules Now to apply the rules. Rules only run when you click that button.
Rules never overwrite your own choices
A rule only moves accounts that are still at the root or were last placed by a rule. An account you placed by hand, or through a CSV, is left alone.
4. With a CSV file (Bulk CSV Import)
Click Bulk CSV Import. The drawer Bulk Hierarchy CSV Import explains the format. The file needs a header row with
Required columns
Example CSV (illustrative values)
- Choose the file and click Upload & Build Tree.
- CostGlass creates any missing nodes (re-using ones that already exist with the same name under the same parent) and places each account.
- The result says how many accounts were mapped and how many were skipped, with the reason for each (at most the first 50 are listed).
Note
Each row must match an account that is already connected. A row for an account CostGlass does not know is skipped with the message "connect it first". The CSV file must be UTF-8. Re-uploading the same file is safe.
Read the rollup numbers
| Number | What it means |
|---|---|
| Monthly Spend | Spend for the current calendar month so far, for every account under the node. It is shown in the fixed-rate unit the rest of the app uses for stored costs, so it can differ slightly from a figure converted at today's exchange rate. |
| Total Accounts | How many accounts sit under the node, including its sub-units. |
| Discovered Resources | Resources found in those accounts that are not terminated. |
| Direct Child OUs | How many nodes are immediately under this one. |
Note
Kubernetes cost is not part of the monthly spend figure, and an account CostGlass has no spend for yet shows nothing, not zero guessed from elsewhere.
Limit people to their branch (Team Access)
1
Select the node
Click the node the person should be limited to.
2
Scope the person
Under Team Permissions & Scoped Access click + Scope Team Member (or Scope a User to this OU). In Scope Team Access to ... choose the person under Select Team Member. The list tells you whether each person is Currently scoped or has Full org access.
3
Confirm
The person now sees only the accounts under that node and its sub-units. The change takes effect within about 30 seconds.
4
Undo it
Click Reset to Full Access beside the person in that node's list. They see the whole organisation again.
A person who is not scoped sees the whole organisation. One person can be bound to one node at a time.
Which pages respect scope
When a person is scoped, these pages and tools show only the accounts under their node: the Dashboard, Cost Explorer, Reports, Resources, Anomalies, Budgets, Savings, Rightsizing, Commitments, Tag Explorer, Tag Compliance, Virtual Tagging and Unit Economics.
Pages that always show the whole organisation
- Cloud Spend (the combined cloud view), Forecasting summaries and Kubernetes Costs combine spend across the organisation and have no per-account breakdown to filter, so scope does not narrow them.
- Spend from SaaS and AI vendors is not tied to an account, so a scoped person does not see their anomalies.
If a figure must be hidden from someone, do not rely on scope alone. Check these pages as that person.
Who can edit the hierarchy
Role limits are not yet enforced here
Today the Hierarchy page does not check a person's role. Any signed-in person in your organisation, including a Member, can create nodes, move accounts and change who is scoped to what. Treat the page as an administrator task and tell your team who is expected to use it. Every change is recorded in the audit log with the person who made it.
A worked example
Two teams, three accounts
- Create two nodes under the root: Payments and Growth.
- Connect your accounts. They appear under Root Unplaced Accounts.
- Create a rule: Field Display Name, operator contains, value pay, destination Payments. Click Add Rule then Run Rules Now.
- Select Growth, click + Attach Accounts and attach the remaining account by hand.
- Select Payments, click + Scope Team Member and choose the Payments lead. They now see only the Payments accounts.
The names are illustrative.
Frequently asked questions
Do I need a particular plan?
The page is in the menu for every plan and the server does not check the plan for it.
Does CostGlass copy my AWS Organizations structure?No. CostGlass does not read the OU layout from AWS Organizations, Azure management groups or similar. You create the nodes yourself and place accounts by hand, by rule or from a CSV. See Designing your hierarchy for a way to mirror your cloud layout.
A new account was connected. Where is it?At the root, counted in Root Unplaced Accounts. Place it yourself, or add a rule and click Run Rules Now.
I ran my rules but an account did not move.Rules only move accounts that are still unplaced or were placed by a rule. An account you placed by hand or by CSV stays where you put it.
Why does a scoped person still see company-wide totals somewhere?A few pages cannot be narrowed. See "Which pages respect scope" above.
Can an account be in two nodes?No. Each account is in one node. If you need a second view of the same spend, use virtual tags.